An FCA principal is fully responsible for the regulated activities its appointed representatives carry on. SUP 12 requires the principal to notify the FCA at least 30 days before an AR starts regulated activity, review each AR at least once every 12 months (introducer ARs aside), and have its governing body approve a written self-assessment of its AR oversight at least once every 12 months. Records of reviews and self-assessments must be kept for at least 6 years.
The appointed representative model concentrates regulatory risk in one place: the principal. Where an AR causes harm, the principal is answerable, and the FCA has made clear through its enhanced regime that weak oversight of ARs is a governance failure at the principal, not a failure of the AR.
What the principal is responsible for
The principal accepts responsibility for the regulated activities the AR carries on under the contract. In practice this means responsibility for the AR's compliance with the rules applicable to those activities, for the suitability and conduct of the AR's staff, for financial promotions communicated in the course of those activities, for complaints arising from them, and for redress.
The AR is not separately authorised. From the customer's perspective and from the FCA's, the principal is the regulated firm.
Pre-appointment due diligence
Due diligence should be documented and should test more than solvency and a company search.
- The AR's business model, target market and distribution method, and whether it fits within the principal's permissions.
- The competence and regulatory history of the AR's controllers and key individuals.
- Financial standing, including the AR's ability to meet potential liabilities.
- Any conflicts arising from the AR's other business, including non-regulated activity.
- The systems and records the AR will use, and the principal's ability to access them.
- Whether the principal has the capacity and expertise to oversee the AR effectively.
That last point is the one most often skipped. A principal that appoints ARs faster than it can supervise them has created the exposure itself.
Key SUP 12 obligations
| Obligation | Rule | Timing |
|---|---|---|
| Notify FCA of a new AR | SUP 12.7.1R | At least 30 days before the AR starts regulated activity |
| Annual review of each AR | SUP 12.6A.2R | At least once every 12 months, except introducer ARs |
| Event-driven review | SUP 12.6A.3R | When the AR changes business model, scope or other trigger events |
| Keep review records | SUP 12.6A.4R | At least 6 years |
| Governing body self-assessment | SUP 12.6A.6R | Reviewed and approved at least once every 12 months |
| Keep self-assessments | SUP 12.6A.8R | At least 6 years from approval |
Ongoing oversight
| Oversight element | Minimum expectation |
|---|---|
| Monitoring plan | Risk-based, documented, with defined frequency per AR |
| File and call testing | Direct sampling of AR customer files by the principal |
| Financial promotions | Pre-approval process with records of approval and version |
| Complaints | Principal receives and records all AR complaints |
| Training and competence | Principal assesses AR staff competence, not just training completion |
| Data and MI | Regular reporting on volumes, revenue, complaints, cancellations |
| Site visits | Periodic, risk-based, with recorded findings |
Oversight based on AR self-certification is not oversight. Where the principal cannot independently test what the AR did, it cannot discharge its responsibility.
The annual self-assessment
Principals must prepare and retain an annual self-assessment of their compliance with the AR requirements, reviewed and approved by the governing body. A credible self-assessment covers the adequacy of the principal's own systems and controls for AR oversight, an assessment of each AR relationship and its risk, the results of monitoring, any harm identified and the action taken, and the principal's capacity to take on further ARs.
Our guidance on the principal self-assessment for appointed representatives covers the document in detail.
Data reporting and notifications
The regime requires principals to provide prescribed information about their ARs, including complaints and revenue data, and to notify the FCA of planned AR appointments in advance and of specified changes. Late or inaccurate AR data reporting is a straightforward and avoidable source of supervisory contact.
Inactive ARs
In April 2026 the FCA published findings on inactive appointed representatives. An AR that reports little or no regulated activity still needs oversight. The principal should understand why it is inactive, check that its website and marketing do not suggest regulated activity it is not carrying on, and decide whether the appointment should continue.
Termination
Ending an AR relationship carries obligations: notification to the FCA, ensuring the AR ceases to hold itself out as representing the principal, arrangements for handling complaints and liabilities arising from the period of appointment, and treatment of customers introduced by the AR. Liability for past conduct does not end with the contract.
About Regulatory Counsel
Regulatory Counsel advises UK and international financial services firms on authorisation, prudential and conduct requirements, governance, financial crime and regulator engagement.
Our appointed representative work covers principal oversight framework design, pre-appointment due diligence, AR monitoring programmes and file testing, annual self-assessment preparation and independent review, AR data reporting controls, and termination and run-off arrangements.
Contact our regulatory team at info@regulatorycounsel.co.uk for a written proposal. AR networks are common in consumer credit, insurance distribution and mortgage broking, and an AR that outgrows the model can apply for its own permission.
This article is provided for general information and does not constitute legal or regulatory advice. Firms should confirm the current position against FCA publications and take advice on their specific circumstances.
Frequently asked questions
A firm or individual carrying on regulated activities under a contract with an authorised firm, the principal, which accepts full regulatory responsibility for those activities. The appointed representative is not separately authorised.
Risk-based monitoring set out in a documented plan, direct testing of AR customer files and calls, pre-approval of financial promotions, complaints capture, competence assessment of AR staff, regular MI and periodic site visits.
A document, reviewed and approved by the principal’s governing body, assessing the adequacy of the principal’s systems and controls for AR oversight, the risk of each AR relationship, monitoring results, harm identified and remedial action, and capacity for further appointments.
Yes. The principal is responsible to the FCA and to customers for the regulated activities the AR carries on under the contract, including financial promotions, complaints and redress.
Notify the FCA, ensure the AR stops holding itself out as representing the principal, make arrangements for complaints and liabilities arising from the appointment period, and address the treatment of customers introduced by the AR.
SUP 12.7.1R requires the principal to submit the SUP 12 Annex 3 form so that the FCA receives it no later than 30 days before the proposed appointed representative begins regulated activities.
At least 6 years. SUP 12.6A.4R covers records of annual and event-driven AR reviews, and SUP 12.6A.8R covers each self-assessment document approved by the governing body.
In its April 2026 good and poor practice findings, the FCA said principals cannot rely on transaction monitoring where there are no transactions. They should understand why an AR is inactive, monitor its public materials and consider ending appointments that no longer serve a purpose.
Definitive guides on this topic
The permanent reference pages this article relates to.